I have created a folder outside of my htdocs directory as a means of adding extra security for downloadable digital goods to be sold from within a Magento storefront; so my question is: what permissions should I set for this non-htdocs directory ("digitalgoods")?

Ownership:

[parent]/htdocs apache:apache
[parent]/digitalgoods apache:apache

I currently have the "digitalgoods" folder set to 770. Does the PUBLIC need read or execute permissions to this folder if the web application will be pulling and serving these files via unique links??

up vote 0 down vote accepted

With owner apache and group apache you should be ok with permissions 550 (the webserver doesn't need to modify the files, only be able to read them). The files will be accessed by users through the webserver anyways. However, in this case it doesn't really matter much, since the only other people on your system are system users, and I don't think you care about them accessing the files.

You probably would want to use a proper security mechanism. Even though the links might be unique, a crawler might still discover them, bypassing your business model. Also customers can share links with others, allowing them to download your files without paying. You will probably want to tie the download to the Magento session or authentication.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.